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Abstract 



> 
o 

' Decoy states have recently been proposed as a useful method for substantially improving 

I the performance of quantum key distribution. Here, we present a general theory of the decoy 



state protocol based on only two decoy states and one signal state. We perform optimization 

on the choice of intensities of the two decoy states and the signal state. Our result shows 

that a decoy state protocol with only two types of decoy states — -the vacuum and a weak 

' decoy state — asymptotically approaches the theoretical limit of the most general type of decoy 
C3 ■ 

^ ' state protocols (with an infinite number of decoy states). We also present a one-decoy-state 
protocol. Moreover, we provide estimations on the effects of statistical fluctuations and suggest 
that, even for long distance (larger than lOOkm) QKD, our two-decoy-state protocol can be 
5_j ■ implemented with only a few hours of experimental data. In conclusion, decoy state quantum 
key distribution is highly practical. 



1 Introduction 

The goal of quantum key distribution (QKD) is to allow two distant parties, Alice and Bob, 
to share a common string of secret (known as the key), in the presence of an eavesdropper, Eve. 
Uniike conventional cryptography, QKD promises perfect security based on the fundamental laws of 
physics. Proving the unconditional security of QKD is a hard problem. Fortunately, this problem 
has recently been solved [SEl- See also |3j. Experimental QKD has been successfuUy demonstrated 
over lOOkm of commercial Telecom fibers |ü] and commercial QKD systems are already on the 
market. The most important question of QKD is its security. Real-life QKD systems are often 
based on attenuated làser pulses (i.e., weak coherent states), which occasionally give out more than 
one photon. This opens up the possibility of sophisticated eavesdropping attacks such as a photon 
number splitting attack, where Eve stops all single-photon signals and splits multi-photon signals. 



keeping one copy herself and re-sending the rest to Bob. The security of practical QKD systems 
has previously been discussed in jTj. 

Hwang P proposed the decoy state method as an important weapon to combat those sophisti- 
cated attack: by preparing and testing the transmission properties of some decoy states, Ahce and 
Bob are in a much better position to catch an eavesdropper. Hwang specifically proposed to use 
a decoy state with an average number of photon of order 1. Hwang's idea was highly innovative. 
However, his security analysis was heuristic. 

In jü], we presented a rigorous security analysis of the decoy state idea. More specifically, we 
combined the idea of the entanglement distillation approach in GLLP[7 with the decoy method 
and achieved a formula for key generation rate 

R > q{-Q,f{E,)H,{E,) + gi[l - i/2(ei)]}, (1) 

where q depends on the implementation (1/2 for the BB84 protocol due to the fact that half of the 
time Alice and Bob disagree with the bases, and if one uses the efficient BB84 protocol lü , g ~ 1), 
the subscript n denotes the intensity of signal states, is the gain [TT] of signal states, is the 
overall quantum bit error rate (QBER), Qi is the gain of single photon states, ei is the error rate 
of single photon states, f{x) is the bi-direction error correction efficiency (See, for example, |12j.) 
as a function of error rate, normally f{x) > 1 with Shannon limit f{x) = 1, and H2{x) is binary 
Shannon Information function, given by, 

H2{x) = -xlog2(x) - (1 - X) log2(l - X). 

Four key variables are needed in Eq. (HJ. and Ef^ can be measured directly from the experi- 
ment. Therefore, in the paper JD^, we showed rigorously how one can, using the decoy state idea to 
estimate Qi and ei, thus achieving the unconditional security of QKD with the key generation rate 
given by Eq. (0). Moreover, using the experimental parameters from a particular QKD experiment 
(GYS) jS], we showed that decoy state QKD can be secure over 140km of Telecom fibers. In sum- 
mary, we showed clearly that decoy state can indeed substantially increase both the distance and 
the key generation rate of QKD. 

For practical implementat ions, we [ïï] also emphasized that only a few decoy states will be 
sufficient. This is so because contributions from states with large photon numbers are negligible in 
comparison with those from small photon numbers. In particular, we proposed a Vacuum+Weak 
decoy state protocol. That is to say, there are two decoy states — a vacuum and a weak decoy 
state. Moreover, the signal state is chosen to be of order 1 photon on average. The vacuum state 
is particularly useful for estimating the background detection rate. Intuitively, a weak decoy state 
allows us to lower bound Qi and upper bound ei. 

Subsequently, the security of our Vacuum+ Weak decoy state protocol has been analyzed by 
Wang • Let us denote the intensities of the signal state and the non-trivial decoy state by /i and 



n' respectively. Wang derived a useful upper bound for A: 

- li' - ^i^^i'e-^^'Q^ ' li'Q^ ' ^ ' 

where A is the proportion of "tagged" states in the sifted key as defined in GLLP [7j. Whereas 
we jÜ] considered a strong version of GLLP result noted in Eq. ((T)), Wang proposed to use a weak 
version of GLLP result: 

R > qQ,{-H2{E,) + (1 - A)[l - H,{^^)]}. (3) 

Such a weak version of GLLP result does not require an estimation of Ci. So, it has the advantage 
that the estimation process is simple. However, it leads to lower vàlues of the key generation rates 
and distances. The issue of statistical fluctuations in decoy state QKD was also mentioned in jl3j . 

Our observation [9^ that only a few decoy states are sufficient for practical implementat ions 
has been studied further and confirmed in a recent paper which is roughly concurrent to the 
present work. 

The main goal of this paper is to analyze the security of a rather general class of two-decoy- 
state protocols with two weak decoy states and one signal state. Our main contributions are as 
foUows. First, we derive a general theory for a decoy state protocol with two weak decoy states. 
Whereas Wang [TÜ] considered only our Vacuum+Weak decoy state protocol i9j (i.e., a protocol 
with two decoy states — the vacuum and a weak coherent state), our analysis here is more general. 
Our decoy method applies even when both decoy states are non- vacuum. Note that, in practice, it 
may be difficult to prepare a vacuum decoy state. For instance, Standard VOAs (variable optical 
attenuators) cannot block optical signals completely. For the special case of the Vacuum+Weak 
decoy state protocol, our result generalizes the work of Wang [Tü] . 

Second, we perform an optimization of the key generation rate in Eq. (^Q) as a function of the 
intensities of the two decoy states and the signal state. Up till now, such an optimization problem 
has been a key unresolved problem in the subject. We solve this problem analytically by showing 
that the key generation rate given by Eq. ^ is optimized when both decoy states are weak. In 
fact, in the limit that both decoy states are infinitesimally weak, we match the best lower bound 
on Yi and upper bound of ei in the most general decoy state theory where an infinite number of 
decoy states are used. Therefore, asymptotically, there is no obvious advantage in using more than 
two decoy states. 

Third, for practical applications, we study the correction terms to the key generation rate when 
the intensities of the two decoy states are non-zero. We see that the correction terms (to the 
asymptotically zero intensity case) are reasonably small. For the case where one of the two decoy 
states is a vacuum (i.e., f2 = 0), the correction term remains modest even when the intensity of the 
second decoy state, vi is as high as 25% of that of the signal state. 

Fourth, following |13j, we discuss the issue of statistical fluctuations due to a finite data size 
in real-life experiments. We provide a rough estimation on the effects of statistical fluctuations in 



practical implementat ions. Using a recent experiment [H] as an example, we estimate that, our weak 
decoy state proposal with two decoy states (a vacuum and a weak decoy state of strength u) can 
achieve secure QKD over more than lOOkm with only a few hours of experiments. A caveat of our 
investigation is that we have not considered the fluctuations in the intensities of Ahce's làser pulses 
(i.e., the vàlues of /i, ui and 1^2)- This is mainly because of a lack of reliable experimental data. In 
summary, our result demonstrates that our two-decoy-state proposal is highly practical. 

Fifth, we also present a one-decoy-state protocol. Such a protocol has an advantage of being 
simple to implement, but gives a lower key generation rate. Indeed, we have recently demonstrated 
experimentally our one-decoy-state protocol over 15km |.15... This demonstrates that one-decoy- 
state is, in fact, sufficient for many practical applications. In summary, decoy state QKD is simple 
and cheap to implement and it is, therefore, ready for immediate commercialization. 

We remark on passing that a different approach (based on strong reference pulse) to making an- 
other protocol (B92 protocol) unconditionally secure over a long distance has recently been proposed 
in a theoretical paper by Koashi [T^ . 

The organization of this paper is as follows. In section |21 we model an optical fiber based QKD 
set-up. In section we first give a general theory for m decoy states. We then propose our practical 
decoy method with two decoy states. Besides, we optimize our choice of the average photon numbers 
^ of the signal state and, ui and z/2 of the decoy states by maximizing the key generation rate with 
the experimental parameters in a specific QKD experiment (GYS) jü]. Furthermore, we also present 
a simple one-decoy-state protocol. In section HI we discuss the effects of statistical fluctuations in 
the two-decoy-state method for a finite data size (i.e., the number of pulses transmitted by Alice). 
Finally, in section we present some concluding remarks. 



In order to describe a real-world QKD system, we need to model the source, channel and detector. 
Here we consider a widely used fiber based set-up model pTTj. 

Source: The làser source can be modeled as a weak coherent state. Assuming that the phase 
of each pulse is totally randomized, the photon number of each pulse follows a Poisson distribution 
with a parameter /i as its expected photon number set by Alice. Thus, the density matrix of the 
state emitted by Alice is given by 



where |0)(0| is vacuum state and is the density matrix of i-photon state for i = 1,2 ■ ■ ■ . 

Channel: For optical fiber based QKD system, the losses in the quantum channel can be derived 
from the loss coefíicient a measured in dB/km and the length of the fiber l in km. The channel 
transmittance íab can be expressed as 



2 Model 




(4) 



i=0 



tAB = lO-Tè. 



Detector: Let rjBob denote for the transmittance in Bob's side, including the internal transmit- 
tance of optical components ÍBob and detector efficiency tid, 



VBob — tBobVD- 

Then the overall transmission and detection efficiency between Alice and Bob r] is given by 

V = tABVBob- (5) 

It is common to consider a threshold detector in Bob's side. That is to say, we assume that Bob's 
detector can teli a vacuum from a non-vacuum state. However, it cannot teli the actual photon 
number in the received signal, if it contains at least one photon. 

It is reasonable to assume the independence between the behaviors of the i photons in i-photon 
States. Therefore the transmittance of i-photon state rji with respect to a threshold detector is given 

by 

^, = i-{i-^y (6) 

fori = 0, 1,2, 

Yield: define Yi to be the yield of an i-photon state, i.e., the conditional probabihty of a 
detection event at Bob's side given that Alice sends out an i-photon state. Note that lo is the 
background rate which includes the detector dark count and other background contributions such 
as the stray light from timing pulses. 

The yield of i-photon states Yi mainly come from two parts, background and true signal. As- 
suming that the background counts are independent of the signal photon detection, then 1^ is given 

by 

Yi^Yo + r]i- Yor]i 

(7) 

= Yo + Vi. 

Hcrc we assume Yq (typically 10^^) and rj (typically 10^'^) are small. 
The gain of i-photon states Qi is given by 

Q^ = r^e-^ (8) 

The gain Qi is the product of the probabihty of Alice sending out an i-photon state (foUows Poisson 
distribution) and the conditional probabihty of Alice's i-photon state (and background) will lead 
to a detection event in Bob. 

Quantum Bit Error Rate: The error rate of i-photon states Cj is given by 

ei = 77 (9) 

where Cdetector is the probabihty that a photon hit the erroneous detector. Cdetector characterizes the 
alignment and stability of the optical system. Experiment ally, even at distances as long as 122km, 
^detector ís morc or Icss independent of the distance. In what foUows, we will assume that Cdetector is 



a constant. We will assume that the background is random. Thus the error rate of the background 
is eo = ^. Note that Eqs. ©, ©, © and © are satisfied for alH = 0, 1, 2, • • • . 
The overall gain is given by 

oo j 



(10) 



(11) 



i=0 

= Fo + 1 - e-"^ 

The overall QBER is given by 

oo j 

3 Practical decoy method 

In this section, we will first discuss the choice of /i for the signal state to maximize the key generation 
rate as given by Eq. (P). Then, we will consider a specific protocol of two weak decoy states and 
show how they can be used to estimate Yi and ei rather accurately. After that, we will show how 
to choose two decoy states to optimize the key generation rate in Eq. (P). As a whole, we have a 
practical decoy state protocol with two weak decoy states. 



3.1 Choose optimal /i 

Here we will discuss how to choose the expected photon number of signal states /i to maximize the 
key generation rate in Eq. (0). 

Let us begin with a general discussion. On one hand, we need to maximize the gain of single 
photon state Qi, which is the only source for the final secure key. To achieve this, heuristically, we 
should maximize the probability of Alice sending out single photon signals. With a Poisson distri- 
bution of the photon number, the single photon fraction in the signal source reaches its maximum 
when /i = 1. On the other hand, we have to control the gain of multi photon state to ensure the 
security of the system. Thus, we should keep the fraction Qi/Q^j, high, which requires /i not to be 
too large. Therefore, intuitively we have 

/íG (0,1]. 

As will be noted in the next Subsection, Alice and Bob can estimate ei and Yí rather accurately 
in a simple decoy state protocol (e.g., one involving only two decoy states). Therefore, for ease of 
discussion, we will discuss the case where Alice and Bob can estimate ei and Yi perfectly. Minor 
errors in Alice and Bob's estimation of ei and Yi will generally lead to rather modest change to the 
final key generation rate R. According to Eqs. (jHI) and (jü)), Qi will be maximized when /i = 1 and 
ei is independent of /i, so we can expect that the optimal expected photon number of signal state 
is /i = 0(1). 



We consider the case where the background rate is low (lo v) ^he transmittance is small 
?7 < 1 (typical vàlues: Yq = 10"^ and rj = 10"^). By substituting Eqs. (jHl), ©, (HDl) and (HH) into 
Eq. ((H), the key generation rate is given by, 



R ^ -r]ljf{edetector)H2{edetector) + í?yUe ^[1 - H 2(6 detector)] 

This rate is optimized if we choose fi = fioptimai which fulfiUs, 

etector )H2{edetector) 



;i -/i)exp(-/i) 



(12) 



1 — H2{edetector) 

where Cdetector is the probabihty that a photon hits the erroneous detector. Then, using the data 
shown in Table ^ extracted from a recent experiment , we can solve this equation and obtain 
that, /ig-^ ~ 0.54 for /(e) = 1 and /í^^Lí ~ 0.48 for /(e) = 1.22. As noted in i, the key 
generation rate and distance are pretty stable against even a 20% change of /i. 



Experiment 


A [nm] 


a [dB/km] 


^detector %] 


Yo 


VBob 


/ 


GYS [5] 


1550 


0.21 


3.3 


1.7 X 10"*^ 


0.045 


2MHz 


KTH ^ 


1550 


0.2 


1 


4 X 10"^ 


0.143 


O.lMHz 



Table 1: Key parameters for QKD experiments. 



3.2 General decoy method 

Here we will give out the most general decoy state method with m decoy states. This extends our 
earlier work in |ïïj. 

Suppose Alice and Bob choose the signal and decoy states with expected photon number 



/i, z/i, z/2, • ■ • , Z/m, they will get the gains and QBER's for signal state and decoy states, 

oo j 

oo 
1=0 

oo j 
í=0 

°° z/* 
^-^ i\ 

j=0 
1=0 



j=0 



_2 
i! 



1=0 

oo j 
í=0 

Question: given Eqs. how can one find a tight lower bound of i?, which is given by Eq. (^? 

This is a main optimization problem for the design of decoy state protocols. 

Note that in Eq. (^, the first term and q are independent of {Yi\ and {ejj.Combining with 
Eq. (jHI), we can simphfy the problem to: 

How to lower bound 

P = ri[l-i/2(ei)] (14) 

with the constraints given by Eqs. (fT^ ? 

When m — > oo, Alice and Bob can solve all {Yi} and {ci} accurately in principle. This is the 
asymptotic case given in p. 



3.3 Two decoy states 

As emphasized in |ü], only a few decoy states are needed for practical implementations. A simple 
way to lower bound Eq. ()14|) is to lower bound Yí and upper bound ei. Intuitively, only two 
decoy states are needed for the estimation of Yi and ei and, therefore, for practical decoy state 
implementation. Here, we present a rigorous analysis to show more precisely how to use two weak 
decoy states to estimate the lower bound Yi and upper bound Ci. 

Suppose Alice and Bob choose two decoy states with expected photon numbers z/i and z/2 which 



satisfy 

< z/2 < z^i ^ ^ 

(15) 

Z/i + z/2 < jJ, 

where fi is the expected photon number of the signal state. 

Lower bound of Yi: Similar to Eq. pü|) . the gains of these two decoy states are given by 

OO j 
% • 

i=0 

OO j 

First Alice and Bob can estimate the lower bound of background rate Yq by z/i x fllfjj) — z/2 x p7|l . 

2 2 

^^iQ.^e'^^ - z/2g.,e^^ = (z/1 - z/2)ro - ^^1^/2(1^2^^^^ + ^3^^^-^ + • • • ) 

< (Z^l - í^2)>0· 

Thus, a crude lower bound of Yq is given by 

Yo>Yq = maxj , 0|, (18) 

z/1 - z/2 

where the equality sign will hold when z/2 = 0, that is to say, when a vacuum decoy (z/2 = 0) is 
performed, Eq. (fTHjl is tight. 

Now, from Eq. (fTüj) . the contribution from multi photon states (with photon number > 2) in 
signal state can be expressed by, 

00 j 

J2Y^^ = Q^.e^-Yo-Y,^^ (19) 

i=2 

Combining Eqs. (fTüjl and (fT7|) . under condition Eq. ()15p . we have 

00 

Q^^e^i - Q^.e·'^ = ri(z/i - z/2) + V -f (z/j - z/^) 

i=2 



i=2 




4- 


z/f 








Z/1 








z/f 





(20) 

>^i(í/i - ^^2) + ^^^^(Q^e^ - >o - >l/u) 
2 2 

< n(í^i - 1^2) + ^^^^(g^^e^ - Fo"^ - Fi/i), 

where Iq'" was defined in Eq. ^1 Here, to prové the first inequality in Eq (j^Üj) . we have made use of 
the inequality that a* — 6* < — 6^ whenever < a + 6 < 1 and i > 2. The equality sign holds for 
the first inequality in Eq (j^ÜI) if and only if Eve raises the yield of 2-photon states and blocks all the 
states with photon number greater than 2 (This was also mentioned in [8J). The second equality in 
Eq (j2Ül) is due to Eq. 



By solving inequality (j^ . the lower bound of Yi is given by 

> y/-.-!-- = ^ . , [g.,e-^ - Q.^e'^^ - íÍ^(Q,e'^ - (21) 

/xz/i - /iz/2 - iy( + ji^ 

Then the gain of single photon state is given by, according to Eq. (jS)), 

Q, > g['---^ = . , [g.,e-^ - Q.,e- - ^Í^(g^e^ - F,^)], (22) 

/ií/l - /ií/2 - Z/f + Z/| fX^ 

where Y^^ is given by Eq. (fT^ . 

Upper bound of ei: According to Eq. (fTT|) . the QBER of the weak decoy state is given by 



E^^Q^^e"^ = eoYo + e,u,Y, + \2e,Y,^ (23) 

OO j 

^.,Q.,e"^ = eolo + eiz/2yi + 5^eíF,^ (24) 



i=2 

An upper bound of Ci can be obtained directly from Eqs. í^ïï)) - 



Note that Ahce and Bob should substitute the lower bound of Fi, Eq. (PT|) into Eq. to get an 
upper bound of ei. 

In summary, by using two weak decoy states that satisfy Eq. Ahce and Bob can obtain 

a lower bound for the yield Yi with Eq. (j?H) (and then the gain Qi with Eq. ()22|) ) and an upper 
bound for the QBER ei with Eq. for the single photon signals. Subsequently, they can use 
Eq. (jH) to work out the key generation rate as 

R > q{-Q,f{E,)H,{E,) + Qf'^-^^ll - H,{e1'^^'^-)]}. (26) 

This is the main procedure of our two-decoy-state protocol. 

Now, the next question is: How good are our bounds for Yi and ei for our two-decoy-state 
protocol? In what follows, we will examine the performance of our two weak decoy state protocol 
by considering first the asymptotic case where both Vi and V2 tend to 0. We will show that our 
bounds for Yi and ei are tight in this asymptotic limit. 

Asymptotic case: We will now take the limit i^i ^ and V2 0. When z/2 < z^i ^ /i = 0(1), 
substituting Eqs. (fTÜ|) . (fTïïj) and (fTTj) into Eq. (j^D), the lower bound of Yi becomes 

-'1 ~ ^1 \ui^0,U2^0 

/iZ/i - /iZ/2 - vi + ^^^^ 

^ ^ [{Yo + Wi)e''' - (lo + W2)e''-'] |.,^o,.2-o 



/i - Z/l - z/2 Z/i - Z/2 



which matches the theoretical value Yi = Fo + ^ from Eq. ((Tj). Substituting Eqs. (fTTj) . and 
into Eq. (j2Sl), the upper bound of ei becomes 

C/,0 _ U,ui,U2 I 

_ epYo + edetectorV (2^) 
Fi 

which matches the theoretical value from Eq. (jüj. 

The above calculation seems to suggest that our two-decoy-state protocol is as good as the most 
general protocol in the limit l'i, 1^2 0. However, in real-life, at least one of the two quantities ui 
and z/2 must take on a non-zero value. Therefore, we need to study the effects of finite z/i and z/2. 
This will be our next subject. 

Deviation from theoretical vàlues: Here, we consider how finite vàlues of ui and perhaps 
1/2 will change our bounds for Yi and Ci. 

The relative deviation of Yi is given by 

= ^-TTlÍ > (29) 

where Y^'^ is the theoretical value of Yi given in Eqs. (|7j) and ()27|). and y^^·'^i'^^ jg estimation 
value of Yi by our two-decoy-state method as given in Eq. (pT|). 
The relative deviation of ei is given by 

U,ui,U2 _ U,0 

Pel = ^ ÜO^^ (30) 

where ef'^ is the theoretical value of ei given in Eqs. (jü)) and ((2HI), and e{'''^^'^^ is the estimation 
value of Cl by our two-decoy-state method as given in Eq. (j^ïïj) . 

Under the approximation rj <^ 1 and taking the first order in Ui and z/2, and substituting Eqs. (|7j), 
f|TÜ|l . (jTïï|l . (ÍT7I) . (HHl) and (jní into Eq. ((23), the deviation of the lower bound of Fi is given by 



T/O i 



- lo + . - - Q^.e^' - "^(Q.^^ - ^o)^ (31) 

-(e'^-l-^-^)( ^ '-).Yo + ie^-l-^.)^^^±^.v. 

2 yU - z/1 - z/2 /i yU - z/1 - z/2 

Substituting Eqs. (HH), (121), (|2l|), (|2HI) and (jSI} into Eq. (jHüI), the deviation of the upper bound 
of Cl is given by 

eiPei = - Cl' 

= ei/?yi + (z/1 + z/2)(ei - ^^). 

Now, from Eqs. and ()32|1 . we can see that decreasing z/i + z/2 will improve the estimation 
of Y'l and ei. So, the smaller z/i + V2 is, the higher the key generation rate R is. In Appendix 
A, we will prové that decreasing z/i + z/2 will improve the estimation of Yí and ei in general sense 



(i.e., without the limit ^ 1 and taking the first order in z/i and 1/2) ■ Therefore, we have reached 
the following important conclusion: for any fixed value of z/i, the choice 1^2 = will optimize the 
key generation rate. In this sense, the Vacuum+Weak decoy state protocol, as first proposed in an 
intuitive manner in is, in fact, optimal. 

The above conclusion highlights the importance of the Vacuum+Weak decoy state protocol. We 
will discuss them in following subsection. Nonetheless, as remarked earlier, in practice, it might 
not be easy to prepare a true vacuum state (with say VOAs). Therefore, our general theory on 
no n- zero decoy states, presented in this subsection, is important. 



3.4 Vacuum+Weak decoy state 

Here we will introduce a special case of Subsection 13.31 with two decoy states: vacuum and weak 
decoy state. This special case was first proposed in jÜ] and analyzed in p!ü]. In the end of Subsec- 
tion 231 we have pointed out that this case is optimal for two-decoy-state method. 

Vacuum decoy state: Alice shuts off her photon source to perform vacuum decoy state. 
Through this decoy state, Alice and Bob can estimate the background rate, 

Q vacuum 

_ 1 ^^^^ 

The dark counts occur randomly, thus the error rate of dark count is Cq = ^. 

Weak decoy state: Alice and Bob choose a relatively weak decoy state with expected photon 
number u < fi. 

Here is the key difference between this special case and our general case of two-decoy-state 
protocol. Now, from vacuum decoy state, Eq. (jïïïïj) . Alice and Bob can estimate lo accurately. So, 
the second inequality of Eq. ()2Ü|) will be tight. Similar to Eq. ()21|). the lower bound of Yi is given 
by 

Y, > y^^·'^·" = y^^'^'^^ |.,_o= —^{Q.e'^ - Q,e^-, - ^^^Yo). (34) 

jjiu — 

So the gain of single photon state is given by, Eq. (jH}, 

Qi > Qi'-"'' = -^^-^{Q.e^ - Q,e^-, - ^^^Y,). (35) 

We remark that Eq. (jMj) can be used to provide a simple derivation of the fraction of "tagged 
photons" A found in Wang's paper [TÜ] . 

Qv 

- Y^e-^ - yi^''^'Ve-^ 

- Y,e-^ - ^{Q^é^ - g.e^g - ^Fo) ^^^^ 



< 



Q 



V 



Indeed, if we replace z/ by /i and /i by /i', Eq. (|ïïüj) will be exactly the same as Eq. (j2I). 
According to Eq. (j2SI), the upper bound of ei is given by 



Deviation from theoretical vàlues: Considering the approximation rj <^ 1 and taking the 
first order in u, similar to Eqs. ()31|) and ()32|). the theoretical deviations of Vacuum+Weak decoy 
method are given by, 



y,pyi = n • - 

= Yo + v ^{Quc" - Q,e^-^ - ^^^Yo) 

«-(e^-l-/i)·r^ + 4(e^-l-/i-^)·yo 

n U,u,0 U,0 

eiPei = ei' ' - 

from which we can see that decreasing p will improve the estimation of Yí and ei. So, the smaller 
is, the higher the key generation rate R is. Later in sectionlH we will take into account of statistical 
fluctuations and give an estimation on the optimal value of u which maximizes the key generation 
rate. 



3.5 One decoy state 

Here we will discuss a decoy state protocol with only one decoy state. Such a protocol is easy to 
implement in experiments, but may generally not be optimal. As noted earlier, we have successfuUy 
performed an experimental implementation of one-decoy-state QKD in |15J . 

A simple proposal: A simple method to analyze one decoy state QKd is by substituting an 
upper bound of Yq into Eq. (jMj) and a lower bound of Yq into Eq. (jïïTj) to lower bound Yi and upper 
bound Cl. 

An upper bound of Yq can be derived from Eq. (fTT|) . 

eo 

Substituting the above upper bound into Eq. (jSH), we get a lower bound on Yi 



Y'l > n^''^ = -^^^{Q,e^ - Q,e^-^ - E^Q.e^^^^). (39) 



A simple lower bound on e\ can be derived as foUows: 

ei < eT'^ = . (40) 

-'1 \^ 



Now, by substituting Eqs. (|ïïüj) and püj) into Eq. ([T)), one obtains a simple lower bound of the 
key generation rate. The above lower bound has recently been used in our experimental decoy state 
QKD paper jT^]. [In our experimental decoy QKD paper we simplify our notation by denoting 
Y^'"'^ by simply Y^ and é('^ by ef .] 

Tighter bound: Another method is to apply the results of Vacuum+Weak decoy described in 
Subsection 13.41 

Let's assume that Alice and Bob perform Vacuum+Weak decoy method, but they prepare very 
few states as the vacuum state. So they cannot estimate Yq very well. We claim that a single decoy 
protocol is the same as a Vacuum+Weak decoy protocol, except that we do not know the value of 
Yq- Since Alice and Bob do not know Iq) Eve can pick Yq as she wishes. We argue that, on physical 
ground, it is advantageous for Eve to pick Yq to be zero. This is because Eve may gather more 
Information on the single-photon signal than the vacuum. Therefore, the bound for the case Yq = 
should still apply to our one-decoy protocol. [We have explicitly checked mathematically that our 
foUowing conclusion is correct, after lower bounding Eq. (fT^ directly.] For this reason, Alice and 
Bob can derive a bound on the key generation rate, i?, by substituting the foUowing vàlues of Y]*'"*'*' 
and ef*"^ into Eq. (0). 



2 

ytrial ^ _J^^Q^^u _ Q y_ 



Arial 



Ytrial 



(41) 



3.6 Example 

Let us return to the two-decoy-state protocol. In Eqs. (j^7|) and ()28|) . we have showed that two- 
decoy-state method is optimal in the asymptotic case where vi,V2 0, in the sense that its key 
generation rate approaches the most general decoy state method of having infinite number of decoy 
states. Here, we will give an example to show that, even in the case of finite vi and z/2, the 
performance of our two-decoy-state method is only slightly worse than the perfect decoy method. 
We will use the model in section|21to calculate the deviations of the estimated vàlues of Yi and ei 
from our two-decoy-state method from the correct vàlues. We use the data of GYS [5^ with key 
parameters listed in Table ^ 

For simplicity, we will use a special two-decoy-state method: Vacuum+Weak. According to 
Eq. (|12j). the optimal expected photon number is /i = 0.48. We change the expected photon 
number of weak decoy z/ to see how the estimates, described by Eqs. (jïï^ and (|ïï7j). deviate from 
the asymptotic vàlues, Eqs. ^ and (jü}. The deviations are calculated by Eqs. and (jïïÜjl . The 
results are shown in Figure ^ From Figure ^ we can see that the estimate for Yi is very good. 
Even at Z///Í = 25%, the deviation is only 3.5%. The estimate for ei is slightly worse. The deviation 
will go to 16.8% when vj[i = 25%. The deviations do not change much with fiber length. Later 
in Section 4, we will discuss how to choose optimal v when statistical fiuctuations due to a finite 



experimental time are taken into account. 
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Figure 1: (Color Online) The sòlid lines show the relative deviations of y^'^^'^'^ and ef'*^^'*^^ from the 
asymptotic vàlues (i.e., the case z/i, z/2 — > 0) as functions oivj^i (where v = v\) with the fiber length 
40km and the dashed lines show the case of 140km. The bounds y^'^^-·^'^ and e^''^^''^^ are given by 
Eqs. (jïï^ and (jïïTj) . and the true vàlues are given by Eqs. ((Tj) and ©. We consider Vacuum+Weak 
protocol here {v\ = v and z/2 = 0). The expected photon number is /i = 0.48 as calculated from 
Eq. (fT^. The parameters used are from GYS as listed in Table[T] 



Let denote for the lower bound of key generation rate, according to (QJ), 

= q{-Q,f{E,)H^{E,) + gf'^^'^íl - iÍ2(ef''''°)]}, (42) 

where q = \ with Standard BB84. The parameters can be calculated from Eqs. (jiup . (jlH) . (j35p and 
fjïïTj) and use /(e) = 1.22, which is the upper bound of /(e) in secure distance for this experiment 
[T^ . Eq. (jSj) shows the relationship between r] and distance. The results are shown in Figure |21 

Now, from Figure we can see that even with finite z/ (say, 0.05), Vacuum+Weak protocol 
performs very close to the asymptotic one. 

We note that Wang [Tü] has also studied a decoy state protocol, first proposed by us [üj, with 
only two decoy states for the special case where one of them is a vacuum. In ^Ü] the second decoy 
state is used to estimate the multi photon fraction A and use the formula directly from GLLP [7] 
to calculate the key generation rate by Eq. 0. 

In Figure |21 we compare the key generation rates of our two-decoy-state method and Wang's 
method (TBI and find that our method performs better. In what follows, we compare the differences 
between our method and that of Wang. 
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Figure 2: (Color Online) The dashed line shows the asymptotic decoy state method (with infinite 
number of decoy states) with a maximal secure distance of 142.05/cm, using Eq. The sòlid 
line shows our Vacuum+Weak decoy method, Eq. (jH)), with = 0.48, ui = 0.05 and z/2 = 0. It 
uses a strong version of GLLP and its maximal distance is 140.55/cm. The dotted line shows the 
asymptotic case of Wang's decoy method, Eq. pïïj) with fi = 0.30. It uses a weak version of GLLP 
and its maximal distance is about 128.55km. This shows that our Vacuum+Weak decoy protocol 
performs very close to the asymptotic limit and performs better than even the asymptotic case of 
Wang's decoy method. The data are from GYS as listed in Table [T] 

• We consider error correction inefficiency /(e) for practical protocols. Wang did not consider 
this real-life issue. For a fair comparison, we add this factor to Eq. Q 

R > qQ,{-f{E,)H,{E,) + (1 - A)[l - H2{^^)]}. (43) 

• Apparently, the value of ^ was chosen in fTÏÏ] in an ad hoc manner, whereas we performed 
optimization in Subsection 3.1 and found that for GYS, the optimal value of /i = 0.48 for 
our two-decoy-state method. Now, the best (asymptotic) estimate Wang's method can make 
is that A = fi when fi' fi. For a fair comparison, we have performed an optimization of 
Wang's asymptotic result Eq. (jlïïjl as well (similar to Subsection 13. 1|) and found that the value 
fi ~ 0.30 optimizes the key generation rate in Wang's method. 

• In Eqs. (12 7|) and (j28|) . we show that our two-decoy-state method approaches a fundamental 
limit of the decoy state (the infinite decoy state protocol) while the asymptotic result in 
Wang [IBI is strictly bounded away from the fundamental limit. Even with a finite vi, our 
Vacuum+Weak protocol is better than Wang's asymptotic case. 



• Why do we get a stronger result than Wang's [Tü]? Wang did not estimate ei and used 
E^/{1 — A) as the upper bound of ei (This corresponds to a weak version of GLLP ^T]). We 
estimate ei more accurately foUowing GLLP (a strong version of GLLP result). 

4 Statistical Fluctuations 

In this section, we would like to discuss the effect of finite data size in real life experiments on our 
estimation process for Yi and Ci. We will also discuss how statistical fluctuations might affect our 
choice of Vi and z/2. We will provide a list of those fluctuations and discuss how we will deal with 
them. We remark that Wang [Tü] has previously considered the issue of fluctuations of Yi. 

All real-life experiments are done in a finite time. Ideally, we would like to consider a QKD 
experiment that can be performed within say a few hours or so. This means that our data size is 
finite. Here, we will see that this type of statistical fluctuations is a rather complex problem. We 
do not have a full solution to the problem. Nonetheless, we will provide some rough estimation 
based on Standard error analysis which suggests that the statistical fluctuation problem of the two- 
decoy-state method for a QKD experiment appears to be under control, if we run an experiment 
over only a few hours. 

4.1 What parameters are fluctuating? 

Recali that from Eq. ([Q), there are four parameters that we need to take into account: the gain 
and QBER of signal state and the gain Qi and QBER ei of single photon sate. The gain of signal 
state is measured directly from experiment. We note that the fluctuations of the signal error 
rate i?^ is not important because i?^ is not used at all in the estimation of Yi and ei. (See Eqs. (PT|) 
and or Eqs. and (jïïTj) .) Therefore, the important issue is the statistical fluctuations of Qi 
and Cl due to the finite data size of signal states and decoy states. 

To show the complexity of the problem, we will now discuss the following five sources of fluctu- 
ations. The first thing to notice is that, in practice, the intensity of the làsers used by Alice will be 
fluctuating. In other words, even the parameters /i, vi and z/2 suffer from small statistical fluctua- 
tions. Without hard experimental data, it is difíicult to pinpoint the extent of their fluctuations. 
To simplify our analysis, we will ignore their fluctuations in this paper. 

The second thing to notice is that so far in our analysis we have assumed that the proportion of 
photon number eigenstates in each type of state is fixed. For instance, if N signal states of intensity 
/i are emitted, we assume that exactly Nfie~^ out of the signal states are single photons. In 
real-life, the number /ie~^ is only a probability, the actual number of single photon signals will 
fluctuate statistically. The fluctuation here is dictated by the law of large number though. So, this 
problem should be solvable. For simplicity, we will neglect this source of fluctuations in this paper. 
[It was subsequently pointed out to us by Gottesman and Preskill that the above two sources of 
fluctuations can be combined into the fluctuations in the photon number frequency distribution of 



the underlying signal and decoy states. These fluctuations will generally average out to zero in the 
limit of a large number of signals, provided that there is no systematic error in the experimental 
set-up.] 

The third thing to notice is, as noted by Wang ^3] , the yield Yi may fluctuate in the sense that 
Yi for the signal state might be slightly different from Yf of the decoy state. We remark that if 
one uses the vacuum state as one of the decoy states, then by observing the yield of the vacuum 
decoy state, conceptually, one has a very good handle on the yield of the vacuum component of 
the signal state (in terms of hypergeometric functions). Note, however, that the background rate is 
generally rather low (typically 10~^). So, to obtain a reasonable estimation on the background rate, 
a rather large number (say 10^) of vacuum decoy states will be needed. [As noted in [ü], even a 20% 
fluctuations in the background will have small effect on the key generation rates and distances.] 
Note that, with the exception of the case = (the vacuum case), neither Yi and F/ are directly 
observable in an experiment. In a real experiment, one can measure only some af era^'ed properties. 
For instance, the yield of the signal state, which can be experimentally measured, has its origin 
as the weighted averaged yields of the various photon number eigenstates Fj's whereas that for 
the decoy state is given by the weighted averaged of y/'s. How to relate the observed averaged 
properties, e.g., Q^, to the underlying vàlues of y^'s is challenging question. In summary, owing to 
the fluctuations of Yi for n > 0, it is not clear to us how to derive a closed form solution to the 
problem. 

Fourth, we note that the error rates, e^'s, for the signal can also be different from the error rates 
Cj's for the decoy state, due to underlying statistical fluctuations. Actually, the fluctuation of ei 
appears to the dominant source of errors in the estimation process. (See, for example, Table|21) 
This is because the parameter ei is rather small (say a few percent) and it appears in combination 
with another small parameter Yi in Eq. (jlip for QBER. 

Fifth, we noted that for security in the GLLP [7j formula (Eq. (1)), we need to correct phase 
errors, rather than bit-flip errors. From Shor-Preskill's proof jü], we know that the bit-flip error 
rate and the phase error rate are supposed to be the same only in the asymptotic limit. Therefore, 
for a finite data set, one has to consider statistical fluctuations. This problem is well studied j^. 
Since the number of signal states is generally very big, we will ignore this fluctuation from now on. 

Qualitatively, the yields of the signal and decoy states tend to decrease exponentially with 
distance. Therefore, statistical fluctuations tend to become more and more important as the distance 
of QKD increases. In general, as the distance of QKD increases, larger and large data sizes will 
be needed for the reliable estimation of Yi and ei (and hence i?), thus requiring a longer QKD 
experiment. 

In this paper, we will neglect the fluctuations due to the first two and the fifth sources listed 
above. Even though we cannot find any closed form solution for the third and fourth sources of 
fluctuations, it should be possible to tackle the problem by simulations. Here, we are contented 
with a more elementary analysis. We will simply apply Standard error analysis to perform a rough 



estimation on the effects of fluctuations due to the third and fourth sources. We remark that the 
origin of the problem is strictly classical statistical fluctuations. There is nothing quantum in this 
statistical analysis. While Standard error analysis (using essentially normal distributions) may not 
give a completely correct answer, we expect that it is correct at least in the order of magnitude. 

Our estimation, which will be presented below, shows that, for long-distance (> lOOkm) QKD 
with our two-decoy-state protocol, the statistical fluctuations effect (from the third and fourth 
sources only) appears to be manageable. This is so provided that a QKD experiment is run for 
a reasonable period of time of only a few hours. Our analysis supports the viewpoint that our 
two-decoy-state protocol is practical for real-life implementations. 

We remark on passing that the actual classical memory space requirement for Alice and Bob is 
rather modest (< IGBytes) because at long distance, only a small fraction of the signals will give 
rise to detection events. 

We emphasize that we have not fully solved the statistical fluctuation problem for decoy state 
QKD. This problem turns out to be quite complex. We remark that this statistical fluctuation 
problem will affect all earlier results including |SI|Ü1E]· In future investigations, it will be interesting 
to study the issues of classical statistical fluctuations in more detail. 



4.2 Standard Error Analysis 

In what follows, we present a general procedure for studying the statistical fluctuations (due to the 
third and fourth sources noted above) by using Standard error analysis. 

Denote the number of pulses (sent by Alice) for signal as Ns, and for two decoy states as A^i 
and N2. Then, the total number of pulses sent by Alice is given by 

N = Ns + Ni + N2. (44) 
Then the parameter q in Eq. (JJ) is given by 

, = ^. (45) 

Here we assume Alice and Bob perform Standard BB84. So, there is a factor of |. 

In practice, since N is flnite, the statistical fluctuations of Qi and ei cannot be neglected. All 
these additional deviations will be related to data sizes Ns, Ni and N2 and can, in principle, be 
obtained from statistic analysis. A natural question to ask is the foUowing. Given total data size 

= const, how to distribute it to Ns, Ni and N2 to maximize the key generation rate R7 This 
question also relates to another one: how to choose optimal weak decoy ui and 1/2 to minimize the 
effects of statistical fluctuations? 

In principle, our optimization procedure should go as follows. First, (this is the hard part) one 
needs to derive a lower bound of Qi and an upper bound of ei (as functions of data size Ns, Ni, 
N2, vi and z/2), taking into full account of statistical fluctuations. Second, one substitutes those 
bounds to Eq. ((T)) to calculate the lower bound of the key generation rate, denoted by . Thus, 



is a function of Ng-, Ni, N2, l'i and 1^2, and will be maximized when the optimal distribution 
satisfies 

dR^ dR^ dR^ 

= = = 0, (46) 

dNs dNi dN2 

given N = Ns + Ni + N2 = const. 



4.3 Choice of ui and 1^2 

Now, from the theoretical deviations of Yi and ei, Eqs. (I29|l and (jïïn|) . reducing u may decrease 
the theoretical deviations. We need to take statistical fluctuations into account. Given a fixed 
A^i + N2, reducing ui and 1^2 will decrease the number of detection events of decoy states, which in 
turns causes a larger statistical fluctuation. Thus, there exists an optimal choice of ui and 1/2 which 
maximizes the lower bound of the key generation rate R^, 

dR^ _ dR^ _ ^ 
dui du2 ' 

which can be simplified to 

7 (47) 
^^Yl^,.,,.-[l-H2{é(^''^n]} = ^. 

Ol>2 

where Y^^'^^''^'^ and e('"^'^'^ are lower bound to Yí and upper bound to ei when statistical fluctuations 
are considered. 

Given total data size in Eq. (jl^ . in principle, one can solve Eqs. (I4fíj) and ()47|1 to get Ns-, Ni, 
N2 h'l and 1^2. 



4.4 Simulat ion: 

In real life, solving Eqs. ()46|) and ()47|) is a complicated problem. In what follows, we will be 
contented with a rough estimation procedure using Standard error analysis commonly used by 
experimentalists. 

Some assumptions: In the following, we will discuss Vacuum+Weak decoy method only. 

1. The signal state is used much more often than the two decoy states. Given the large number 
of signal states, it is reasonable to ignore the statistical fluctuations in signal states. 

2. We assume that the decoy state used in the actual experiment is conceptually only a part of 
an infinite population of decoy states. There are underlying vàlues for Q^, and E^, as defined 
by the population of decoy states. In each realization, the decoy state allows us to obtain 
some estimates for these underlying Q,^ and E^, . Alice and Bob can use the fluctuations of 
Qu, Ey to calculate the fluctuation of the estimates of Yi and Ci. 

3. We neglect the change of f{E^) due to small change in E^. 



4. When the number of events (e.g. the total detection event of the vacuum decoy state) is large 
(say > 50), we assume that the statistical characteristic of a parameter can be described by 
a normal distribution. 

We will use the experiment parameters in TableC]and show numerical solutions of Eqs. ()44|) . 
(I4fí|l and ()47j) . We pick the total data size to be = 6 x 10^. Now, the GYS experiment 1.5.^ has a 
repetition rate of 2MHz and an up time of less than 50% ^üj. Therefore, it should take only a few 
hours to perform our proposed experiment. The optimal fj, = 0.48 can be calculated by Eq. |T2|) 
and we use /(e) = 1.22. 

In the fiber length of 103.62/cm (r/ = 3 x 10~^), the optimal pulses distribution of data, u and 
the deviations from perfect decoy method are listed in Table El 
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Table 2: The pulse number distribution and v are calculated from Eqs. ()46|) and (@7j). B is the lower 
bound of final key bits. All results are obtained by numerical analysis using MatLab. The variable 
jSyi denotes the relative error in our estimation process of Yi from its true value by using the data 
from a finite experiment. This relative error originates from statistical fiuctuations. This definition 
contrasts with the definition of (3yi in Eq. ()29|) which refers to the relative difference between the 
vàlues of Yi for the case i) where vi and z/2 are finite and the case ii) where vi and z/2 approach zero. 
Similarly, other /5's denote the relative errors in our estimates for the corresponding variables in the 
subscript of (5. All the statistical fiuctuation is of the confidence interval of ten Standard deviations 
(i.e., 1 - 1.5 X 10-23). The data come from GYS 0, listed in Tabled 

For each fiber length we can solve Eqs. (Pü|l and (jTfj) to get Ns, Ne, Ni, N2 and z/. 

Figure 121 shows how the optimal v changes with fiber length. We can see that the optimal z/ is 
small (~ 0.1) through the whole distance. In fact, it starts at a value z/ 0.04 at zero distance and 
increases almost linearly with the distance. 

Figure m shows Vacuum+Weak with statistical fiuctuations as compared to the asymptotic 
case of infinite decoy state and without statistical fiuctuations. We can see that even taking into 
account the statistical fiuctuations, the Vacuum+Weak protocol is not far from the asymptotic 
result. In particular, in the short distance region, our two-decoy-state method with statistical 
fiuctuations approaches the performance of the asjTuptotic limit of infinite decoy states and no 
statistical fiuctuations. This is so because the channel is not that lossy and statistical fiuctuations 
are easily under control. This fact highlights the feasibility of our proposal. 

Wang picked the total data size A^ = 8.4 x lO^''. For long distance QKD, this will take more 
than one day of experiment with the current GYS set-up ^5j . In order to perform a fair comparison 
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Figure 3: (Color Online) The sòlid line shows the simulation result of the Vacuum+Weak protocol 
(Eqs. (jMj) and ()37|) ) with statistical fluctuations. The dashed line shows the result for one-decoy- 
state method (Eqs. (jS}). Here, we pick the data size (total number of pulses emitted by Ahce) to 
be = 6 X 10^. We find the optimal i/'s for each fiber length by numerically solving Eqs. ()44|1 . 
()46|) and ()47|). The confidence interval for statistical fluctuation is ten Standard deviations (i.e., 
1 — 1.5 X 10^^'^). The data are from GYS |3] as listed in Table ^ The expected photon number 
of signal state is calculated by Eq. (fT^. getting fj, = 0.48. The second decoy state (vacuum decoy) 
becomes useful at 82km. 

with Wang[TÜ]'s result, we will now the data size = 8.4 x 10^°. Figure shows vs. fiber 
length l with = 8.4 x 10^° fixed and compares our Vacuum+Weak protocol with Wang's result. 
Comments: 

• Wang chooses the value of /i in an ad hoc manner. Here we note that, for Wang's 
asymptotic case, the optimal choice of /i is ;U G [0.25, 0.3] 

• Even if we choose /i G [0.25,0.3], the maximal secure distance of Wang's asymptotic case is 
still less than our two-decoy-state method with statistical fluctuations. In other words, the 
performance of our two-decoy-state method with statistical fluctuations is still better than 
the the asymptotic value (i.e., without considering statistical fluctuations) given by Wang's 
method. 

• Note that GYS |ïïj has a very low background rate (Yq = 1.7 x 10"^) and high Cdetector- The 
typical vàlues of these two key parameters are Yq = 10~^ and Cdetector = !%• If the background 
rate is higher and edetector is lower, then our results will have more advantage over Wang's. 
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Figure 4: (Color Online) The dotted line shows the performance of perfect decoy state method 
(with infinite number of decoy states and no statistical fluctuations) . The maximal distance is 
about 142km. The sòlid line shows the simulation result of the Vacuum+Weak protocol (Eqs. (jïï^) 
and ()37|)) with statistical fluctuations. Its maximal distance is about 125km. The dashed line 
shows the result for one-decoy-state method (Eqs. (j^T| ) with maximal distance 122km. We pick a 
data size (i.e., total number of pulses emitted by Alice) to be = 6 x 10^. Note that even with 
statistical fluctuations and a rather modest data size, our Vacuum+Weak decoy protocol performs 
rather close to asymptotic limit, particularly at short distances. The second decoy state (vacuum 
decoy) becomes useful at 82km. The data are from GYS [Hj as listed in Table Q The expected 
photon number of signal state is calculated by Eq. (fT^ . getting /i = 0.48. 

We illustrate this fact in Figure |ülby using the data from the KTH experiment P^ . 

5 Conclusion 

We studied the two-decoy-state protocol where two weak decoy states of intensities ui and z/2 and a 
signal state with intensity /i are employed. We derived a general formula for the key generation rate 
R of the protocol and showed that the asymptotically limiting case where ui and z/2 tend to zero 
gives an optimal key generation rate which is the same as having infinite number of decoy states. 
This result seems to suggest that there is no fundamental conceptual advantage in using more than 
two decoy states. Using the data from the GYS experiment , we studied the effect of finite z/i and 
z/2 on the value of the key generation rate, R. In particular, we considerd a Vacuum+Weak protocol, 
proposed in and analyzed in where 1^2 = and showed that R does not change much even 
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Figure 5: (Color Online) Here, we consider the data size (i.e., the number of pulses emitted by 
Alice) to be = 8.4 x 10^°, foUowing Wang ^ÏÏ]. The dashed line shows the performance of perfect 
decoy state method. Its maximal distance is 142km. The sòlid line shows the simulation result 
of the Vacuum+Weak decoy state method with statistical fiuctuations. Its maximal distance is 
132km. The dotted line shows the asymptotic case (i.e., an idealized version) of Wang's method. 
Its maximal distance is 128.55km. This figure shows clearly that with a data size N = 8.4 x 10^'', our 
protocol, which considers statistical fiuctuations, performs better even than the idealized version 
of Wang's protocol, where statistical fiuctuations are neglected. For our asymptotic case and two- 
decoy with statistical fiuctuation /i = 0.48, and for Wang's asymptotic case /i = 0.3, which are 
optimized. 

when z/i/yU is as high as 25%. We also derived the optimal choice of expected photon number fi of the 
signal state, following our earlier work p]. Finally, we considered the issue of statistical fiuctuations 
due to a finite data size. We remark that statistical fiuctuations have also been considered in the 
recent work of Wang Jü]. Here, we listed five different sources of fiuctuations. While the problem 
is highly complex, we provided an estimation based on Standard error analysis. We believe that 
such an analysis, while not rigorous, will give at least the correct order of magnitude estimation to 
the problem. This is so because this is a classical estimation problem. There is nothing quantum 
about it. That is to say there are no subtle quantum attacks to consider. Our estimation showed 
that two-decoy-state QKD appears to be highly practical. Using data from a recent experiment 
jïï], we showed that, even for long-distance (i..e, over lOOkm) QKD, only a few hours of data are 
sufíicient for its implementation. The memory size requirement is also rather modest (< IGBytes). 
A caveat is that we have not considered the fiuctuations of the làser intensities of Alice, i.e., the 
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Figure 6: (Color Online) Here, we compare various protocols using the parameters in KTH |18j . 
listed in Table ^ and J7] . The dashed line shows the performance of perfect decoy state method. 
It has a maximal secure distance of about 68.6km. The sòlid line shows the simulation result of the 
Vacuum+Weak decoy state method with statistical fluctuations. The maximal distance is about 
67.2km). The dotted line shows the asymptotic case (i.e., neglecting statistical fluctuations) of 
Wang's method whose maximal distance is about 55.5km. For our asymptotic case and two-decoy 
with statistical fiuctuation /i = 0.77, and for Wang's asymptotic case /i = 0.43, which are optimized. 

value of yU, ui and z/2. This is because we do not have reliable experimental data to perform such 
an investigation. For short- distance QKD, the effects of statistical fluctuations are suppressed 
because the transmittance and useful data rate are much higher than long-distance QKD. Finally, 
we noted that statistical fluctuations will affect our choice of decoy states ui and 1^2 and performed 
an optimization for the special case where z/2 = 0. 

In summary, our investigation demonstrates that a simple two decoy state protocol with Vac- 
uum+Weak decoy state is highly practical and can achieve unconditional security for long-distance 
(over lOOkm) QKD, even with only a few hours of experimental data. 

As a final note, we have also studied a simple one-decoy-state protocol. Recently, we have 
experimentally implemented our one-decoy-state protocol over 15km of Telecom fibers thus 
demonstrating the feasibility of our proposal. 
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A Appendix 

In this appendix, we will prové that the Vacuum+Weak decoy protocol is optimal among the two- 
weak-decoy protocol. We do so by proving that, for a fixed ui (which is larger than z/2), 

• the lower bound Y-^'"^'"^ can be no greater than Y-^'"^'^, see Eq.(|ïïïïj) 

• the upper bound ef''^^''^^ can be no less than e^'^^'^, see Eq. (jïïTj) 

We will consider those bounds as given in Eqs. (j?H) and (j^üj) . In what follows, we assume the 
conditions given by Eq. (fTïïjl . 

< z/2 < ^1 



z/1 + z/2 < /i. 

Theorem Given /i, z/i, rj, Yq and Cdetector, the lower bound of Yi given in Eq. (j?T|) . 

/iZ/i - /iZ/2 - Z/f + Z/| jJ,^ 

is a decreasing function of z/2, and the upper bound of ei given in Eq. 

rr E O e"^ — E O e"'^ 



(4í 



(^1 - Z/2)n^'^^'^^ 

is an increasing function of z/2, under conditions Eq. (jll·l)) . Here Q^, Q^^, Qj/j, E^, E^^^ and E^y^ are 
given by Eqs. (HÜD and (ÍTT|l . 

Proof of the theorem First we will prové Y^'"^''^^ is a decreasing function of z/2 and then prové 
^u,ui,u2 increasing function of 1^2. 



Define functions and J(/x) as 

= (Fo + 1 - e-^'^)e'^ 
J(/i) = E^Q^e^ 

= [eoYo + edetectoril ' e"i^)]e^ . 

Take the first derivative of G(/i) and J(/i), 

which are both increasing functions and > 0, J'{n) > 0. By mathematical induction, it is 

not difiicult to prové the foUowing claim. 

Claim 1: For any order derivative of G{ii) and G^^'^fx) > and J*^")(/i) > are increasing 

functions. 

Some Useful Inequalities: With Claim 1 and the Taylor Series of G{fi), we have 



> jjiG\jj) 



G(/i) = 5^G«(/i) 

í=0 



^! (49) 



According to Mean Value Theorem, 

G{ui) - G{u2) 



G'{v,) 

Z/l - V2 

where pzi^í £ [^^2, Because G"(/i) and J'(/i) are increasing functions, we can bound Eq. (|50|l . 

GV.) < " < G>.) (51) 

Z/l — z/2 

JV,) < ZíílWW < j-,,,). (52) 

Ul - z/2 



Similarly, 



Define a function 



G"(z/2) < ^'^""'^ ~ ^^^'^^^ < G"(z/0. (53) 

Z/i — z/2 



F(í/2) = IQ.e'^ ^{Qu.e"^ - Qu.e"^)] 

/i - Z/i - z/2 Z/i - Z/2 



^ -[G(/i)-^^(G(z/i)-G(z/2))] 



/i - z/1 - z/2 Z/1 - Z/2 

Claim 2: The function F{v2) is an increasing function of z/2, under the conditions given in Eq. (|48|) . 



Proof of Claim 2: To determine if the function is increasing or decreasing we will need the 
derivative. 

(^/i — Z/i — z/2 J Ui — Z/2 

, ^ ,, [Giui) - G(z/2)] 

/i - z/1 - z/2 (z/1 - Z/2)^ 

+ ^ ^G"(z/2) 

/i - Z/i - Z/2 Z/i - Z/2 

>7 ^ ^[^(/x) - mG"(z/i)] 

(/i - Z/1 - Z/2)2 ^ ^ (54) 

^ ^G"(z/i) + ^G"(z/2) 

|U - z/1 - z/2 z/1 - z/2 /i - Z/1 - Z/2 Z/1 - Z/2 

>7 ^ T-.if^G'if^) - /.G'(z/i + z/2)] ^ G"(z/i) 

> [G"(z/i + z/2) - G"(z/i)] 

/i — Z/i — z/2 

>0 

Here, to prové the first inequality, we have made use of Eq. (jïïT|) : to prové the second inequahty, we 
have made use of Eq. í^üj). and Claim 1; to prové the third inequahty, we have made use of 
Eq. (|53p: to prové the last inequahty, we have made use of Claim 1. 

Proof that Y-^'"^'"'^ is a decreasing function. Re-write the lower bound of Yi, in Eq. 

,2 ,,2 



yUZ/1 - yUZ/2 - z/f + z/2 IX·^ 



2 I ^ Qv2^ ^) ,,2 I ,.2 ..2 Qfi^^^ 



HVi - /iZ/2 - Z/f + Z/| /iZ/i - yUZ/2 - Z/f + Z/| /i 



/i Q^,e^i -g^^e'^^ z/i + z/2 Q^e'^ 



fl- Ul - 1/2 z/1 - z/2 /i - Z/1 - Z/2 /i 

/^^ Qí^i^ ^ ~ Qi^2^ ^ _ ( — )Q 



(55) 



/i - z/1 - z/2 Z/1 - Z/2 /i - Z/1 - Z/2 

= -Q^e^ ^ [g^e^ ^(Q.ie'^^ - Q^.e''')] 

fi /i - Z/i - z/2 Z/l - Z/2 

= -Q^e^-F(z/2). 
/i 

With Claim 2, we show that Y^'"^''^^ is a decreasing function of z/2. 
Define a function 

p n pi'l _ o 

A(Z/2j = 

Z/1 - Z/2 

_ J(z/i) - J(z/2) 
Z^l - Z^2 

Claim 3: function K{v2) is an increasing function with V2- 



Proof: to determine if the function is increasing or decreasing we will need the derivative. 

A {V2) = —7 

(z/1 - Ui - 1/2 

^ J'{i^2) _ J'{y2) (56) 
= 0, 

where the first inequality is due to Eq. (fü^ . 

Proof that e(''^^'^'^ is an increasing function. Reform the lower bound of ei, in Eq. ()25p . 



K{U2) ^^^^ 



With Claim 3 and decreasing function of Y^''^^''^'^, we show that e^''^^'''^ is an increasing function of 
In summary, we have proved the theorem. 
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